Threat Source newsletter (Jan. 7, 2021)
Summary: The FBI issued a warning this week about a global Egregor ransomware campaign that has targeted at least 150 organizations worldwide in attacks dating back to September, using phishing emails with malicious attachments and insecure Remote Desktop Protocol or Virtual Private Networks for initial infection. The actors also use tools including Cobalt Strike, Qakbot/Qbot, Advanced IP Scanner and AdFind for privilege escalation and lateral network movement.
What you should know: At least 150 organizations have already been hit since September, and the intrusion paths named are phishing attachments and exposed RDP or VPN - the same entry points most enterprises still leave open.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026